RFR: 8269039: Disable SHA-1 Signed JARs [v3]

[Sean Mullan]

> This change will disable JARs signed with algorithms using SHA-1 by default, and treat them as unsigned. This applies to the algorithms used to digest, sign, and optionally timestamp the JAR. It also applies to the signature and digest algorithms of the certificates in the certificate chain of the code signer and the Timestamp Authority, and any CRLs or OCSP responses that are used to verify if those certificates have been revoked. The specific details are more fully described in the CSR: https://bugs.openjdk.java.net/browse/JDK-8272155.
> 
> Some additional notes about the fix:
> 
> - This change was previously backed out of JDK 17 and delayed because of performance regressions. The overall performance is still to be verified, but the primary bottlenecks were addressed as follows:
>     - `sun.security.util.DisabledAlgorithmConstraints` no longer depends on `java.text.SimpleDateFormat` to format date fields which is expensive.
>     - the `jdkCA` constraint has been removed as this caused the `cacerts` keystore to be loaded. Applications  using SHA-1 JARs signed by certificates that chain back to private CAs and are impacted by the restrictions can, at their own risk, adjust the properties and add back in the `jdkCA` constraint.
>  - `jarsigner` has been enhanced to more accurately warn about algorithms that are disabled based on the constraints specified in the security properties. Previously it had used a simpler scheme which did not take into account constraints such as `Usage` or `DenyAfter`. Similar changes should also be made to `keytool` but that will be addressed in a separate issue.
>  - Some SHA-1 JARs used by tests where it does not affect the results have been re-signed with SHA-2 algorithms.

Sean Mullan has updated the pull request incrementally with one additional commit since the last revision:

  Add back DynStatic.java test which was accidentally removed in prior commit.

-------------

Changes:
  - all: https://git.openjdk.java.net/jdk/pull/5320/files
  - new: https://git.openjdk.java.net/jdk/pull/5320/files/d797f32a..ae1ea608

Webrevs:
 - full: https://webrevs.openjdk.java.net/?repo=jdk&pr=5320&range=02
 - incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=5320&range=01-02

  Stats: 96 lines in 1 file changed: 96 ins; 0 del; 0 mod
  Patch: https://git.openjdk.java.net/jdk/pull/5320.diff
  Fetch: git fetch https://git.openjdk.java.net/jdk pull/5320/head:pull/5320

PR: https://git.openjdk.java.net/jdk/pull/5320